CYBER BREACH FALLOUT

34 www.uslaw.org USLAW
CYBERSECURITY
The New
Professional Risk
PART 2 OF 4: KEEPING CUSTOMERS’ DATA CLOSE TO THE VEST – CYBERSECURITY
CHALLENGES IN THE RETAIL, RESTAURANT AND HOSPITALITY INDUSTRY
The recent cyberattacks on large corporations
such as Neiman Marcus, Target,
eBay and Home Depot have brought cybersecurity
to the forefront of mainstream pop
culture, as the data stolen from these retailers
exposed the personal identifiable information
of millions of customers. Stolen
credit card data typically is posted online
and sold on the black market at prices ranging
from $3 per Social Security number to
as much as $1,000 per bank account login.
While these figures seem modest,
when multiplied by
the millions affected, the
financial and reputational
damage inflicted
can easily ruin any business.
In fact, once a retailer
suffers a major breach, consumer
confidence drops, resulting
in a significant drop
in profit. As the total average
cost of a data breach is now
$3.8 million, up from $3.5
million the previous year, the
question facing companies is
not only how to prevent a cyberattack,
but how to position
themselves to sufficiently and
quickly respond to same. In the
second of a four-part series
touching on various professional,
business and insurance sectors, this article
discusses cybersecurity and compliance issues
facing the retail, restaurant and hospitality
(RRH) industry in today’s rapidly
evolving technological climate.
TYPES OF DATA BREACHES
AFFECTING THE RETAIL, RESTAURANT
AND HOSPITALITY INDUSTRY
The number of reported data security
breaches continues to increase while the
types of breaches are becoming more diverse
and sophisticated. Retail companies are
often targeted by cyber criminals because
they possess voluminous financial data across
their chain of stores throughout the country
Karen Painter Randall and Steven A. Kroll
Connell Foley LLP
and overseas. Often these companies are victims
of Point-of-Sale malware. In general,
there are three basic types of data security
breaches that affect the RRH industry and
lead to the compromise of a business’ data:
physical breach, electronic breach and
skimming. The following is a brief
overview of each type of
breach.
PHYSICAL
BREACH
The first type of data
breach affecting businesses in the
RRH industry relates to a physical breach.
This involves the physical theft of documents
or equipment containing cardholder account
data, such as cardholder receipts, files, PCs
and Point-of-Sale terminals. A physical breach
can also involve terminal scams wherein an
individual attempts to tamper with merchant
Point-of-Sale terminals in order to gain access
to card data contained in the device or to perpetrate
fraud using the device. For example,
a terminal scam may include phone calls received
by merchants in which the caller attempts
to reprogram client terminals.
Some best practices for a business in the
RRH industry to employ to help prevent a
physical data breach include: having a detailed
security strategy that involves monitoring
employees who use Point-of-Sale
terminals and conveying clearly defined restrictions
to them; installing cameras at computer
room entrances and exits as well as
check-out lanes where Point-of-Sale terminals
are positioned; defining procedures
to monitor the cameras
and corporate networks and
keep recorded footage for a
reasonable period of time;
requiring ID badges
for access to sensitive
data centers;
and maintaining a
log of visitors to
sensitive facility
areas.
ELECTRONIC
BREACH
A second type of
breach affecting the
RRH industry is an electronic
breach. This involves
the unauthorized
access or deliberate attack on a system or
network environment (at a business or its
third-party processor) where cardholder
data is processed, stored or transmitted.
This can be the result of acquiring access,
via Web servers or Web sites, to a system’s
vulnerabilities through application-level attacks.
Some examples of system vulnerabilities
include unsecured remote access, lack
of proper password management, and lack
of proper access restrictions to cardholder
data systems.
There are a number of methods used
by hackers in the case of an electronic data
breach. For example, a “packet sniffer” is an
application that intercepts and logs traffic
passing over a digital network or part of a
network. This is a standard tool that has
been used in network troubleshooting and
analysis for many years. Unfortunately, this